3 ms·

It'd be nice if CertSimple had a LetsEncrypt (obviously with some kind of auth - perhaps based on a secondary private/public key pair unrelated to the certifica

It'd be nice if CertSimple had a LetsEncrypt (obviously with some kind of auth - perhaps based on a secondary private/public key pair unrelated to the certificate(s)?) style tool to allow issuing/renewing certificates for a known account. I understand that the initial proof of entity needs some human involvement on our end, but surely once it's proved, renewals could be automated?

nailer 10y ago
Automated issuance is on our roadmap and ACME/Certbot support is something we'd like to do if possible. We still have some prequisites we need to sort out first (like proper subscription billing) but the idea is solid. ACME would be preferable over a custom automatic renewal mechanism since theoretically it would allow existing clients to get and renew EV certs automatically but we'll have to start actually hacking it to see. You still need to reconfirm identity before the new cert is issued. E.g., we have a lot of startups as customers and they often forget to pay a bill, and are no longer an active entity according to their Secretary of State (we flag this up before payment). So it wouldn't ever be entirely automated but that doesn't meant we can't do automated renewal: ACME tries to renew repeatedly a month before the cert expired and we can block until identity is reconfirmed.
- stephenr 10y ago
  Do you have the specific steps/requirements for each country documented somewhere?
  - nailer 10y ago
    The country, and TLD, and type-of-business (active registered company, DBA, sole prop, onion), and other logic (detecting inconsistencies between data sources, determining if whois privacy is in use, etc) are implemented and documented in source code - CertSimple itself is an engine to meet those rules and handle those exceptions. The requirements for EV itself are in CABForum docs, see https://certsimple.com/blog/are-ev-ssl-certificates-worth-it https://certsimple.com/blog/are-ev-ssl-certificates-worth-it for an overview.

nailer 10y ago

Automated issuance is on our roadmap and ACME/Certbot support is something we'd like to do if possible. We still have some prequisites we need to sort out first (like proper subscription billing) but the idea is solid. ACME would be preferable over a custom automatic renewal mechanism since theoretically it would allow existing clients to get and renew EV certs automatically but we'll have to start actually hacking it to see. You still need to reconfirm identity before the new cert is issued. E.g., we have a lot of startups as customers and they often forget to pay a bill, and are no longer an active entity according to their Secretary of State (we flag this up before payment). So it wouldn't ever be entirely automated but that doesn't meant we can't do automated renewal: ACME tries to renew repeatedly a month before the cert expired and we can block until identity is reconfirmed.

stephenr 10y ago
Do you have the specific steps/requirements for each country documented somewhere?
- nailer 10y ago
  The country, and TLD, and type-of-business (active registered company, DBA, sole prop, onion), and other logic (detecting inconsistencies between data sources, determining if whois privacy is in use, etc) are implemented and documented in source code - CertSimple itself is an engine to meet those rules and handle those exceptions. The requirements for EV itself are in CABForum docs, see https://certsimple.com/blog/are-ev-ssl-certificates-worth-it https://certsimple.com/blog/are-ev-ssl-certificates-worth-it for an overview.